DNS over HTTPS vs a VPN: who sees what

DNS over HTTPS (DoH) is not a VPN. DoH hides your name lookups from the network between you and one resolver; a VPN carries all of your traffic, lookups included, to an exit server.

Think of a DNS resolver as the server that turns a name such as example.org into an address. Every site you open starts with a question to one. That question is what both tools change, in different ways.

Who can see my DNS queries with plain DNS, DoH, a VPN, and both?

With plain DNS, anyone on the path can read the lookup. With DoH, only the resolver you named can. With a VPN, the lookup travels inside the tunnel and the resolver at the exit's end answers. With both, the DoH provider answers and the network on your side sees only the tunnel.

RFC 8484 defines DoH: the lookup goes as an HTTPS request, so it looks like other web traffic on port 443. Plain DNS uses port 53 and is readable by whoever carries it.

If you pick a DNS operator in the VPN app instead of the default, that operator answers the lookup, reached through the tunnel, and it sees the names. Read it by column. The two DoH-only cells that stay "your network" are the point of the next sections. Encrypting the lookup does not remove the connection that follows it.

What does a packet capture show with DoH and a VPN on and off?

We captured packets on a Linux desktop in four states, counting only protocol, port and interface. Plain DNS appeared on the physical adapter only with the tunnel down and DoH off. With the tunnel up, the physical adapter carried no plain DNS at all.

Two things stand out:

• DoH changes the size of the lookup traffic. 273 and 248 packets against 38, because every lookup becomes an HTTPS exchange with a handshake and framing.
• The tunnel changes the adapter. In the two tunnel-up states the physical adapter carried only UDP on non-DNS ports, which is how the tunnel's own packets look from outside, plus some control packets.

Which resolver answers when both are on?

The DoH provider answers. With the tunnel up and Firefox set to DoH only, the browser's lookups were HTTPS to the provider's address, carried on the tunnel adapter, and 4 plain DNS packets passed to and from the tunnel's own resolver, the lookup of the provider's host name.

That last detail is worth knowing. A browser needs an address for the DoH provider before it can use it.

With no fixed bootstrap address, that first question goes to the system resolver. In our run it went through the tunnel. In the tunnel-down DoH state we saw one plain DNS pair on the physical adapter in the idle window before the page loads; we did not tie it to a name.

So the VPN does not override browser DoH. It changes the road the HTTPS request travels. Firefox documents that its default differs by version and region. Chrome turns secure DNS on in automatic mode and falls back to an unencrypted lookup if the provider fails. Check the setting in the browser you use.

With DoH off and the tunnel up, the system resolver on the tunnel link answered: 38 plain DNS packets on the tunnel adapter, 0 on the physical one. The physical link kept its own resolver configured, unused for those lookups.

What does DNS over HTTPS not hide?

DoH hides the lookup and nothing after it. Once your device has the address, it connects to it, and your network sees that destination address, its timing and the size of what flows.

The site name usually leaks a second time. In a TLS handshake the browser tells the server which site it wants in a field called the Server Name Indication (SNI), sent in the clear. Encrypted Client Hello (ECH) masks the SNI.

It needs the site and the browser to support it, and the browser learns the key through DNS HTTPS records. Cloudflare's page notes that a network's resolver can drop the ECH settings from those records, and browsers then connect without ECH.

A VPN hides all three from your ISP and the network on your side, and moves them to the VPN exit's side. It does not remove them: the exit server sees destination addresses, and the DoH provider, if you chose one, still sees every name. Trust moves; it does not disappear. See what a VPN does for the longer version.

• DoH only: the resolver you picked sees the names; your network sees the addresses.
• VPN only: the exit's side sees names and addresses; your network sees one tunnel.
• Both: your chosen DoH provider sees the names, and the exit's side sees the addresses.

When is DNS over HTTPS alone enough, and when do you add a VPN?

DoH alone is enough when the thing you want to keep from the network is the lookup, and you accept that it still sees where you connect. A shared café network reading your name lookups is the plain case; the connection address stays visible, so it is a partial answer.

Add a VPN when the addresses and timing matter too, or when you want one setting for every app. Browser DoH covers that browser. A tunnel covers every app on the device, including those with no secure DNS setting, unless you use split tunnelling (by app on Android, by IP range on Windows and Linux): excluded apps stay outside it.

On Android, Private DNS is the system-wide analogue, using DNS over TLS (RFC 7858) on port 853; see Always-on VPN, battery and Private DNS. We did not test it.

If you want filtering, choose a filtering DNS provider. ForestVPN's DNS setting lists named operators and sends your lookups to the one you pick through the tunnel; the filtering is that operator's, and it sees your names.

How can I check which path my lookups take?

Count packets by port on each adapter, before and after the change. You need a Linux or macOS machine, a terminal and a browser.

1. Start a capture on all interfaces with tcpdump -i any -nn -q 'port 53', piped to awk '{print $2}' | sort | uniq -c or just wc -l, so you keep a count per interface and no addresses.
2. Load one neutral page three times with the VPN off. Count packets on port 53 per interface.
3. Turn on your browser's secure DNS and repeat. Port 53 should drop to a bootstrap lookup or none, and port 443 traffic to the provider should rise.
4. Connect the VPN, wait until the app shows "Protected", and repeat both. You should see no port 53 and no DoH-provider traffic on the physical interface.
5. Run a resolver test too. A DNS leak test page lists the resolvers it saw; read each row by asking who chose it.

If the tunnel will not come up, start with VPN connected but no internet. For the IPv6 side of the same question, see IPv6 leaks. ForestVPN also needs no email: your sign-in is a number.